Menu

Category Archives: Other

VULNERABILITY DEVELOPMENT MASTER CLASS

Since our inception we have prided ourselves on providing training courses on a variety of advanced subjects which have consistently been filled with students from around the world. Last year, we hosted the class in the USA, Asia, and Europe, both publicly and also privately by request.

Once again, our flagship course, the Vulnerability Development Master Class, returns for 2015 and will be taught by some of Exodus’ top experts. As the class is given over 5 consecutive days, it is not for the faint of heart. Don’t let that intimidate you, though, as we have done our best to structure the course to elevate students from a basic knowledge of assembly language to learning and practicing the skills necessary to find and exploit the zero-day vulnerabilities they discover during the class. None of the software audited during the course is contrived–every target is a real application with wide market penetration in the enterprise. We believe adhering to real-world examples helps students understand, in context, the severity of the flaws they unearth.

Testimonials

“The Exodus Intel VulnDev Master Class was an exceptional, cutting-edge course for skilled VR specialists to push their skills further. It was a wonderful example of practical techniques and creativity applied to modern targets. The Exodus team focused on passing on their approach and mentality to the student, giving the student the ability to take the “Exodus approach” for their own VR work.”

“I had an amazing time during the vuln-dev course in Amsterdam. And was really disappointed when I had to go to work again the next Monday. Loved the entire course learned a lot, even popped a 0day after the course!”

“Vuln Dev Master Class delivered a shower of knowledge on finding and exploiting vulnerabilities in complex, relevant applications. It was one of the most wow-factor courses I have attended.”

“The course was excellent and the Exodus team show why they’re among the best at what they do.”

“The Vulnerability Development Master class was excellent; packed with good information, examples, and actual real world attacks and scenarios and taught by people who clearly know what they are doing.”

Dates & Locations

The dates and locations are as follows (venue information will be distributed to registered attendees):

April 13th-17th: Austin, TX, USA

July 6th-10th: Amsterdam, Netherlands

September 7th-11th: Frankfurt, Germany

If we receive sufficient interest in hosting additional events the above list may expand. Reach out to us via training@exodusintel.com or on twitter via @ExodusIntel for any inquiries.

Check out a sneak peek of the training venue in downtown Austin below:

Prerequisites

Abstract

This 5 day course is designed to provide students with a comprehensive and progressive approach to understanding advanced vulnerability and exploitation topics. Attendees will be immersed in hands-on exercises that impart valuable skills including static and dynamic reverse engineering, zero-day vulnerability discovery, and advanced exploitation of widely deployed server and client-side applications.

Taught by some Exodus Intelligence’s leading experts, this course provides students with direct access to our renowned professionals in a setting conducive to individual interactions.

Syllabus

Reverse Engineering

Static Reverse Engineering

Code Representation and Graph Theory

Recognizing Non-Determinism

Recognizing Data Structures

Symbol Mining

Harvesting Useful Code

C++ Type Recovery

Scripting Disassemblers

Dynamic Reverse Engineering & Automation

Non-Intrusive Target Monitoring

Recovering Type Information

Code Flow Analysis

Symbol Recovery

Isolating Interesting Code & Data

Debugging

Core Windows Userspace Concepts

Memory Management

Process Lineage

Integrity Levels

Windows Services

Inter-Process Communication

Local Inter-Process Communication

Remote Process Communication

The Windows Linker & Loader

Exception Handling

Core Debugger Concepts

Attaching (Intrusive vs Non-Intrusive)

Breakpoints

Global Flags

Image File Execution Options

Scripting with PyKD

Annoyances & Solutions

Vulnerabilities Overview & Recognition

Recognizing Vulnerability Patterns

Automated Discovery

Memory Corruption

Type Confusion

Improper Allocations

Arithmetic Issues

Format Strings

Use-After-Free

Buffer Overflows

Design Flaws

Vulnerability Discovery

Manual Auditing Processes

Dumb Fuzzing

“Intelligent” Fuzzing

Ambulance Chasing

Binary Diffing

Client-Side Discovery Techniques

Server-Side Discovery Techniques

Exploitation

Memory Manipulation & Scope

Windows Mitigations & Bypasses

Enhanced Mitigation Experience Toolkit (EMET)

Bypassing EMET

Achieving Reliability

Post Exploitation

Sandboxes

Process Continuation

Pricing and Registration

The cost for the 5-day course is $6500 USD per student. You may e-mail training@exodusintel.com to register and we will supply an invoice. We have also made available this template request form for individuals to help justify attendance to management.

Throughout 2013 we have given training courses on a variety of advanced subjects which have consistently been filled with students from around the globe. The classes have been hosted both publicly at security events, our headquarters in Texas, and privately at military and government institutions. As the year draws to a close, we’ve had a chance to reflect on the content we’ve taught and how we can raise the bar even higher in 2014. To that end, we’re excited to announce that we have combined material from our Breaking Binary Applications, Bughunting and Analysis 101, Dynamic Reverse Engineering, and Browser Exploitation classes into a single week-long master course that we will deliver publicly at 3 locations in 2014.

The new course, titled the Vulnerability Development Master Class, will be taught by the entire Exodus team over the course of 5 consecutive days.

Dates & Locations

The dates and locations are as follows (venue information will be distributed to registered attendees):

March 24th-28th: Boston, MA, USA

July 7th-11th: Amsterdam, The Netherlands

September 15th-19th: San Francisco, CA, USA

If we receive sufficient interest in hosting additional events the above list may expand. Reach out to us via training@exodusintel.com or on twitter via @ExodusIntel for any inquiries.

Prerequisites

Abstract

This 5 day course is designed to provide students with a comprehensive and progressive approach to understanding advanced vulnerability and exploitation topics on the Windows platform. Attendees will be immersed in hands-on exercises that impart valuable skills including static and dynamic reverse engineering, zero-day vulnerability discovery, binary instrumentation, and advanced exploitation of widely deployed server and client-side applications.

Taught by the entire Exodus Intelligence team, this course provides students with direct access to our renowned professionals in a setting conducive to individual interactions.

Syllabus

Reverse Engineering

Static Reverse Engineering

Code Representation and Graph Theory

Recognizing Non-Determinism

Recognizing Data Structures

Symbol Mining

Harvesting Useful Code

C++ Type Recovery

Scripting Disassemblers

Dynamic Reverse Engineering & Automation

Non-Intrusive Target Monitoring

Recovering Type Information

Code Flow Analysis

Symbol Recovery

Instrumentation with PIN

Isolating Interesting Code & Data

Debugging

Core Windows Userspace Concepts

Memory Management

Process Lineage

Integrity Levels

Windows Services

Inter-Process Communication

Local Inter-Process Communication

Remote Process Communication

The Windows Linker & Loader

Exception Handling

Core Debugger Concepts

Attaching (Intrusive vs Non-Intrusive)

Breakpoints

Global Flags

Image File Execution Options

Scripting with PyKD

Annoyances & Solutions

Vulnerabilities Overview & Recognition

Recognizing Vulnerability Patterns

Automated Discovery

Memory Corruption

Type Confusion

Improper Allocations

Arithmetic Issues

Format Strings

Use-After-Free

Buffer Overflows

Design Flaws

Vulnerability Discovery

Manual Auditing Processes

Dumb Fuzzing

“Intelligent” Fuzzing

Ambulance Chasing

Binary Diffing

Client-Side Discovery Techniques

Server-Side Discovery Techniques

Exploitation

Memory Manipulation & Scope

Windows Mitigations & Bypasses

Enhanced Mitigation Experience Toolkit (EMET)

Bypassing EMET

Achieving Reliability

Post Exploitation

Sandboxes

Process Continuation

Pricing and Registration

The cost for the 5-day course is $6500 USD per student. You may e-mail training@exodusintel.com to register and we will supply a purchase order.

Exodus Intelligence is excited to announce a new service offering developed via a partnership with Syndis, an Icelandic information security think-tank based in Reykjavik.

Here at Exodus, we focus exclusively on developing sophisticated zero-day exploits that mimic the characteristics of real-world advanced attackers. By partnering with Syndis, we are able to put these tools in the hands of their seasoned team of security professionals, thereby allowing our joint customers to experience what it would be like to be targeted by a well-equipped adversary. Departing from the check-box security mentality and entering engagements as if they were actual attacks conducted by operators with sophisticated zero-day vulnerabilities results in metrics that enable our clients to empirically analyze and improve their defensive methodologies.

A LiveFire exercise is unlike any other service offering on the market; we’ve studied high-profile breaches and analyzed the tactics of today’s most capable adversaries to ensure that the experience we deliver is on-par, and even above, what a high-value target must be prepared to withstand.

LiveFire: This is not a drill.

As you may know, we recently brought Rolf Rolles on board the team here at Exodus. We all met at our Austin office and Rolf spent a week working alongside us. Our interview process doesn’t consist of contrived questions intended to observe the interviewee’s capacity for mental acrobatics. Traditionally, when we bring someone in for consideration we are already familiar with their past work and skillset. What we are more interested in is evaluating their capacity to work as part of our team. So, Rolf spent his time auditing code and writing some instrumentation tools for some of the problems we were facing at the time. It went very well, and we’re thrilled that he decided to join us.

One night during that week we were chatting with Rolf about random programming problems and he recalled the story of a past interview whereby he was asked to implement a strlen() function in C that, when compiled, would not contain any conditional branches. He didn’t pose the problem as a challenge but Brandon, Zef, and I all found it intriguing and took a shot at solving it. Leave it to Rolf Rolles to reverse the interview process itself…

“So, my immediate thought was to use function pointers to ‘conditionally’ execute code without a conditional branch. There are two possible states for each member of a string when performing a ‘strlen’-type operation. ‘Terminator’ and ‘Not Terminator’. In this case the ‘Terminator’ for a C-string is ‘NULL’ (0x00). This of course is the only value with 0 bits set; by masking each bit in the 8 bit value and shifting to the lsb then combining the values with a ‘|’ operation, a binary state is created allowing for the indepedent execution of the two defined states ‘Terminator’ and ‘Not Terminator'”.

As I admittedly suck at C, I approached the problem in straight assembly (I know, that’s cheating. And yes, this could be achieved with a rep scasb, but that’s just too easy). However, I was able to solve the problem in 27 bytes:

The three pops that occur within _start are to get access to argv[1] (the string to be measured, provided on the command line). The last pop esi puts a pointer to the string into the esi register.

The mov al, [esi] grabs a single byte off the string. Then, the add al, 0xFF is used to determine whether the byte is NULL or not. If the value is non-NULL, the add to the 8-bit register al will set the Carry flag. If it is NULL, it will not set the CF.

The next instruction is actually considered undocumented (even objdump shows the mnemonic as ‘bad’). What the salc instruction does is sets the al register to 0xFF if the Carry flag is set, otherwise it sets it to 0x00. This is the method I used to implement a binary state to determine if the character is NULL or not.

The inc al instruction then increments al, which was either 0xFF or 0x00. After the inc it will either be 0x00 or 0x01.

The lea ecx, [0x8048097+eax*4] instruction loads into ecx either the address 0x8048097 or 0x804809b. These addresses are significant and can be observed by objdump’ing the assembled binary:

So, if the character is not NULL, the code will jmp ecx to 0x8048097 which increments the string length counter (ebx) and increments the string pointer (esi) and then branches unconditionally to _continue.

If the value was NULL, the jmp ecx will land directly at the int 0x80. As the size of the inc ebx and inc esi and jmp _continue is exactly 4 bytes, the lea instruction very conveniently can load either the address of the inc ebx or directly at the int 0x80, thus removing the need for any NOP-like instructions.

The last convenient optimization to note is that the int 0x80 will execute the syscall specified by the eax register. Well, because the result of the add/salc/inc condition will set eax to 1 only when a NULL is found, the int 0x80 will execute syscall #1 which on Linux is exit(). Additionally, the exit code is specified by the ebx register. That is why I used the ebx register as my counter to hold the string length. So, upon execution of the interrupt, the exit code will contain the length of the string as can be observed by running the assembled binary and inspecting the return value:

“Basically, the fundamental problem to overcome with this challenge is to ‘make a decision’ — that is to say, decide when to terminate the iteration upon reaching a NULL character — without using an explicit jcc-style conditional branch. A few minutes’ reflection upon this problem yields that we could use recursion into a function pointer table with 256 entries, where 255 of the entries increased some counter variable, and the entry at 0 terminates the procedure and returns the counter. In doing so, we have replaced all conditional jumps with one indexed, switch jump. Some further reflection provides the reduction of the table size from 256 entries down to two.”